cryptdir

#!/bin/bash

# SPDX-FileCopyrightText: 2024 sudorook <daemon@nullcodon.com>
#
# SPDX-License-Identifier: GPL-3.0-or-later
#
# This program is free software: you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the Free
# Software Foundation, either version 3 of the License, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
# for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program. If not, see <https://www.gnu.org/licenses/>.

set -eu

ROOT="$(dirname "${0}")"

source "${ROOT}"/globals

! check_command grep sed && exit 3

#
# Functions
#

function set_icon {
  if check_command gio && [ -n "$(whereis -b gvfs | cut -d ":" -f 2)" ]; then
    gio set "${DECRYPTPATH}" -t string metadata::custom-icon-name folder-unlocked
  fi
  if check_command kwriteconfig5; then
    kwriteconfig5 --file "${DECRYPTPATH}/.directory" --group 'Desktop Entry' --key 'Icon' 'folder-unlocked'
  fi
}

function unset_icon {
  if check_command gio && [ -n "$(whereis -b gvfs | cut -d ":" -f 2)" ]; then
    gio set --delete "${DECRYPTPATH}" metadata::custom-icon-name
  fi
  if check_command kwriteconfig5; then
    kwriteconfig5 --file "${DECRYPTPATH}/.directory" --group 'Desktop Entry' --key 'Icon' --delete
  fi
}

function mount_crypt_dir {
  if grep -q "${DECRYPTPATH}" /etc/mtab; then
    show_warning "${DECRYPTPATH} is already mounted."
    exit
  fi

  case "${CRYPTTOOL,,}" in
    cryfs)
      cryfs "${ENCRYPTPATH}" "${DECRYPTPATH}"
      ;;
    ecryptfs)
      local encryptname
      local pass
      local hash

      if ! lsmod | grep -q ecryptfs; then
        show_info "Loading ecryptfs kernel module."
        sudo modprobe ecryptfs
      fi

      if [ -d "${HOME}/.ecryptfs" ]; then
        mkdir -p "${HOME}/.ecryptfs"
      fi

      encryptname="${ENCRYPTPATH##*/}"
      encryptname="${encryptname#\.}"
      if ! [ -f "${HOME}/.ecryptfs/${encryptname}.conf" ]; then
        echo "${ENCRYPTPATH}	${DECRYPTPATH}	ecryptfs" > \
          "${HOME}/.ecryptfs/${encryptname}.conf"
      fi
      if ! [ -f "${HOME}/.ecryptfs/${encryptname}.mnt" ]; then
        echo "${DECRYPTPATH}" > \
          "${HOME}/.ecryptfs/${encryptname}.mnt"
      fi

      pass="$(ask_secret "Password:")"
      if ! [ -f "${HOME}/.ecryptfs/${encryptname}.sig" ]; then
        hash="$(printf "%s" "${pass}" |
                  ecryptfs-add-passphrase - |
                  sed -n "s/.*\[\([0-9a-z]\+\)\].*/\1/p")"
        echo "${hash}" > "${HOME}/.ecryptfs/${encryptname}.sig"
        echo "${hash}" >> "${HOME}/.ecryptfs/${encryptname}.sig"
      else
        printf "%s" "${pass}" | ecryptfs-add-passphrase -
      fi

      mount.ecryptfs_private "${encryptname}"
      ;;
    encfs)
      encfs "${ENCRYPTPATH}" "${DECRYPTPATH}"
      ;;
    gocryptfs)
      if ! [ -f "${ENCRYPTPATH}"/gocryptfs.conf ]; then
        gocryptfs -init "${ENCRYPTPATH}"
      fi
      gocryptfs "${ENCRYPTPATH}" "${DECRYPTPATH}"
      ;;
  esac

  if grep -q "${DECRYPTPATH}" /etc/mtab; then
    set_icon
    show_success "Decrypted successfully."
  else
    show_error "Decryption failed."
    exit 3
  fi
}

function unmount_crypt_dir {
  if ! grep -q "${DECRYPTPATH}" /etc/mtab; then
    show_warning "${DECRYPTPATH} is not decrypted."
    exit
  fi

  if ! grep -q "^${CRYPTTOOL} ${DECRYPTPATH}" /etc/mtab; then
    show_warning "Selected ${CRYPTTOOL@Q} does not match /etc/mtab entry."
    exit
  fi

  case "${CRYPTTOOL,,}" in
    cryfs)
      cryfs-unmount "${DECRYPTPATH}"
      ;;
    ecryptfs)
      local encryptname
      encryptname="${ENCRYPTPATH##*/}"
      encryptname="${encryptname#\.}"
      umount.ecryptfs_private "${encryptname}"
      ;;
    encfs)
      fusermount -u "${DECRYPTPATH}"
      ;;
    gocryptfs)
      fusermount -u "${DECRYPTPATH}"
      ;;
  esac

  if ! grep -q "${DECRYPTPATH}" /etc/mtab; then
    unset_icon
    show_success "Encrypted successfully."
  else
    show_error "Encryption failed."
    exit 3
  fi
}

function check_crypttool {
  case "${CRYPTTOOL,,}" in
    cryfs)
      if ! check_command cryfs; then
        exit 3
      fi
      ;;
    ecryptfs)
      if ! check_command ecryptfs-stat; then
        exit 3
      fi
      ;;
    encfs)
      show_warning "EncFS has security issues. (https://defuse.ca/audits/encfs.htm)"
      if ! check_command encfs fusermount; then
        exit 3
      fi
      ;;
    gocryptfs)
      if ! check_command fusermount gocryptfs; then
        exit 3
      fi
      ;;
    *)
      show_error "ERROR: ${CRYPTTOOL@Q} not supported. Exiting."
      exit 3
      ;;
  esac
}

function print_usage {
  show_header "Usage: cryptdir on|off"
  cat << EOF

  -e|--encrypt_dir  path to directory with encrypted data (${ENCRYPTPATH})
  -d|--decrypt_dir  directory path to mount decrypted data (${DECRYPTPATH})
  -s|--crypt_std    encryption standard (${CRYPTTOOL})

  crypt_std options: 'cryfs', 'ecryptfs', 'encfs', and 'gocryptfs'

  Use 'on' to decrypt an encrypted store and 'off' to encrypt an decrypted
  mounted directory.
EOF
}

#
# Globals
#

ENCRYPTPATH="${encryptpath:-${HOME}/.encrypted}"
DECRYPTPATH="${decryptpath:-${HOME}/.decrypted}"

CRYPTTOOL=cryfs

#
# Main
#

OPTIONS=d:e:s:h
LONGOPTIONS=decrypt_dir:,encrypt_dir:,crypt_std:,help
PARSED=$(getopt -o "${OPTIONS}" --long "${LONGOPTIONS}" -n "${0}" -- "${@}")
eval set -- "${PARSED}"

while [ "${#}" -ge 1 ]; do
  case "${1}" in
    -d | --decrypt_dir)
      DECRYPTPATH="${2}"
      shift 2
      ;;
    -e | --encrypt_dir)
      ENCRYPTPATH="${2}"
      shift 2
      ;;
    -s | --crypt_std)
      CRYPTTOOL="${2}"
      shift 2
      ;;
    -h | --help)
      print_usage
      exit
      ;;
    --)
      shift
      break
      ;;
    *)
      show_error "ERROR: Unknown argument ${1@Q}. Exiting."
      exit 3
      ;;
  esac
done

check_crypttool

if ! [ "${#}" -eq 1 ]; then
  show_error "ERROR: Incorrect # of parameters. Exiting."
  exit 3
fi

mkdir -p "${ENCRYPTPATH}" "${DECRYPTPATH}"

case "${1}" in
  on | mount | decrypt)
    mount_crypt_dir
    ;;
  off | unmount | encrypt)
    unmount_crypt_dir
    ;;
  *)
    show_error "ERROR: Unrecognized option ${1@Q}. Exiting."
    exit 3
    ;;
esac